Hi,

The following vulnerability was published for python-asteval.

CVE-2026-55244[0]:
| ASTEVAL is an evaluator of Python expressions and statements. Prior
| to 1.0.9, FROM_PY in asteval/astutils.py exposes BaseException,
| SystemExit, KeyboardInterrupt, and GeneratorExit to expressions
| evaluated by asteval.Interpreter.eval(), while run() and eval() in
| asteval/asteval.py catch Exception rather than these non-Exception
| BaseException subclasses. When an attacker-controlled expression
| raises one of these classes, on_raise() passes the class to
| raise_exception(), and the resulting exception bypasses the
| interpreter's safety handlers and propagates into the calling
| application. A consuming service that evaluates untrusted
| expressions can therefore be terminated or have signal and cleanup
| handling disrupted, causing denial of service. The separately
| documented read-only open() capability is not part of this
| vulnerability. This issue is fixed in version 1.0.9.


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-55244
https://www.cve.org/CVERecord?id=CVE-2026-55244
[1] https://github.com/lmfit/asteval/security/advisories/GHSA-89v8-rhwq-hf77
[2] https://github.com/lmfit/asteval/pull/153

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore